CVE-2026-57852

Name of the Vulnerable Software and Affected Versions Grav CMS scheduler-webhook plugin (affected versions not specified)

Description An authentication bypass exists in the scheduler-webhook plugin due to a short-circuit logic flaw during webhook token validation. This allows unauthenticated remote attackers to trigger configured scheduled jobs by sending a POST request to the scheduler webhook endpoint. Attackers can execute all configured jobs or target a specific one, leading to the unintended execution of operator-defined commands under the privileges of the web server process user.

Recommendations At the moment, there is no information about a newer version that contains a fix for this vulnerability.